refactor password update